molt-verify

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides documentation and examples for executing the molt verify command-line utility. These commands are used to perform schema and data integrity checks between source and target databases during migrations.
  • [CREDENTIALS_UNSAFE]: The documentation references the use of database connection strings via the --source and --target flags. These strings often contain sensitive credentials. The skill includes a 'Gotchas' section and flag descriptions that explicitly warn against using --show-connection-logging in production to prevent leaking these credentials into log files.
  • [EXTERNAL_DOWNLOADS]: The skill specifies requirements for the molt binary and the Oracle Instant Client (for Oracle migrations). These are documented as prerequisites for the tool's operation rather than being downloaded or executed via automated scripts.
  • [PROMPT_INJECTION]: The skill documents an attack surface where user-provided input (connection strings, table filters) is passed to a shell command. However, this is standard functionality for database tooling and does not contain malicious override instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 09:40 PM
Security Audit — agent-trust-hub — molt-verify